Attackers working for a China-aligned group dubbed Storm-0940 have leveraged AI agents to attempt unauthorized access to more than 2,250 Microsoft 365 tenants. According to Microsoft’s technical analysis, the threat actors used stolen ConnectWise application credentials to tap into existing trust relationships, enabling them to bypass typical defenses like interactive passwords and multi-factor authentication prompts. Not every targeted tenant showed evidence of a successful breach.
How ARTEX Automation Powers the Campaign
The attackers employed a tool called ARTEX, a framework designed to orchestrate multiple AI agents for tasks spanning reconnaissance, authentication probing, and establishing long-term cloud persistence. By using stolen ConnectWise credentials, the campaign bypassed the need for new vulnerabilities—operations were conducted through legitimate application permissions that victims had granted in advance.
Observations from Huntress show that the bulk of suspicious activity occurred during a single intensive window on October 15, when an automated sweep touched nearly 1,000 tenants sequentially. In another attack burst, about 100 authentication token requests were sent within just 10 seconds. That amount of volume and coordination indicates use of parallel AI agent workers operating without waiting for feedback before continuing.
When errors cropped up—such as uploading a certificate with a mismatched thumbprint—ARTEX adapted. Within seconds, retries descended across several intervals, and the system moved the refined approach to additional tenants. Attackers also manipulated application permissions: at one point a Teams-application service principal self-elevated to Global Administrator. While some parts of the campaign ran continuously even after the immediate target was removed, suggesting lingering automation or background tasks.
Challenges in Detection and Protection Gaps
One of the major investigation obstacles was that Microsoft Graph activity logging was largely missing among victims, which hinders understanding of what data was accessed or stolen. Entra (Microsoft’s identity governance service) also fails to capture Graph reads in its audit logs. As a result, even when authentication success is clear, what information was consumed remains hard to determine.
Microsoft’s earlier findings showed a related password-spraying attack sweeping through 327 accounts across eight organizations, racking up over 151,000 failed login attempts. Peaks included rates of 2,900 failed attempts per minute—though many of those attempts were unsuccessful and not confirmed as part of the ConnectWise credential abuse.
Security experts recommend closely monitoring vendor applications for privilege escalation, persistent credential or secret changes, and application identities acting outside of usual norms. Enabling Microsoft Graph logging, cross-tenant monitoring, and preserving evidence before deleting applications are also advised. Microsoft warns that even after removing the primary access path, credentials may still exist elsewhere.
Indicators of compromise include specific IP addresses tied to token requests and ConnectWise activity, along with unusual user-agents like “Python-urllib/3.12”, “curl/7.88.1”, and others consistent with containerized or scripted tools.
This incident represents a growing shift: threat actors are combining stolen credentials with AI-driven automation to launch faster, more adaptable attacks. The network distribution, the retry logic, and the role escalations all signal a new level of stealth and persistence. Organizations must treat AI agent-driven attacks as a real and emerging risk rather than speculation. What comes next will likely test the limits of existing identity security tools—and those that ignore this evolution may soon find themselves exposed.
